System and Method for Encryption and Decryption of Data

• US 20110225428A1
• Filed: 03/10/2010
• Published: 09/15/2011
• Est. Priority Date: 03/10/2010
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Nelson, Amy Christine, Stufflebeam, Kenneth W. JR.
• Granted Patent: US 9,135,471 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

Systems and methods for reducing problems and disadvantages associated with traditional approaches to encryption and decryption of data are provided. A method for encryption and decryption of data, may include encrypting or decrypting data associated with an input/output operation based on at least one of an encryption key and a cryptographic function, wherein at least one of the encryption key and the cryptographic function are selected based on one or more characteristics associated with the data to be encrypted or decrypted. Another method may include encrypting an item of data based on at least one of a first-layer encryption key and a first-layer cryptographic function to produce first-layer encrypted data and encrypting the first-layer encrypted data based on at least one of a second-layer encryption key and a second-layer cryptographic function to produce second-layer encrypted data.

Claims

1. An information handling system, comprising:

a processor;

a memory communicatively coupled to the processor; and

a computer-readable medium coupled to the processor and having stored thereon instructions for managing encryption and decryption tasks, the instructions configured to, when executed by the processor, encrypt or decrypt data associated with an input/output operation based on at least one of an encryption key and a cryptographic function, wherein at least one of the encryption key and the cryptographic function are selected based on one or more characteristics associated with the data to be encrypted or decrypted.

2. An information handling system according to claim 1, the one or more characteristics comprising:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and any other characteristic of a storage resource associated with the input/output operation.

3. An information handling system according to claim 1, wherein the cryptographic function includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

4. An information handling system according to claim 1, wherein the one or more characteristics are determined based on a security policy.

5. An information handling system according to claim 4, wherein the security policy is established by an administrator at a management console remote from the information handling system and communicated to the information handling system.

8. A method according to claim 1, wherein the cryptographic function includes at least one of an encryption algorithm, an algorithm mode, a cryptographic hash, and a sign function.

9. An method according to claim 1, wherein the one or more characteristics are determined based on a security policy.

6. A method for encryption and decryption of data, comprising encrypting or decrypting data associated with an input/output operation based on at least one of an encryption key and a cryptographic function, wherein at least one of the encryption key and the cryptographic function are selected based on one or more characteristics associated with the data to be encrypted or decrypted.

7. A method according to claim 6, the one or more characteristics comprising:

a user associated with the information handling system, a port to which a storage resource associated with the input/output operation is coupled, a type of storage resource associated with the input/output operation, a manufacturer of a storage resource associated with the input/output operation, a model of a storage resource associated with the input/output operation, a serial number of a storage resource associated with the input/output operation, a logical path of a storage resource associated with the input/output operation, and a file type of the data to be encrypted or decrypted.

10. A method according to claim 6, further comprising:

establishing the security policy by an administrator at a management console remote from the information handling system; and

communicating the security policy to the information handling system.

11. An information handling system, comprising:

a processor;

a memory communicatively coupled to the processor; and

a computer-readable medium coupled to the processor and having stored thereon instructions for encrypting an item of data, the instructions configured to, when executed by the processor;

encrypt the item of data based on at least one of a first-layer encryption key and a first-layer cryptographic function to produce first-layer encrypted data; and

encrypt the first-layer encrypted data based on at least one of a second-layer encryption key and a second-layer cryptographic function to produce second-layer encrypted data.

12. An information handling system according to claim 11, the instructions further configured to encrypt the second-layer encrypted data based on at least one of a third-layer encryption key and a third-layer cryptographic function to produce third-layer encrypted data.

13. An information handling system according to claim 11, wherein the first-layer encryption key and the first-layer cryptographic function are unique to a first component of the information handling system and the second-layer encryption key and the second-layer cryptographic function are unique to a second component different than the first component.

14. An information handling system according to claim 13, wherein each of the first component and the second component comprises one of:

a user of the information handling system, a processor of the information handling system, a storage resource of the information handling system, a bus via which a storage resource of the information handling system is coupled, a cryptoprocessor of the information handling system, and an encryption accelerator of the information handling system.

15. An information handling system according to claim 11, the instructions further configured to:

decrypt the second-layer encrypted data based on at least one of the second-layer encryption key and the second-layer cryptographic function to produce first-layer encrypted data; and

decrypt the first-layer encrypted data based on at least one of the first-layer encryption key and the first-layer cryptographic function to produce the item of data.

16. A method for encrypting data, comprising:

encrypting an item of data based on at least one of a first-layer encryption key and a first-layer cryptographic function to produce first-layer encrypted data; and

encrypting the first-layer encrypted data based on at least one of a second-layer encryption key and a second-layer cryptographic function to produce second-layer encrypted data.

17. A method according to claim 16, further comprising encrypting the second-layer encrypted data based on at least one of a third-layer encryption key and a third-layer cryptographic function to produce third-layer encrypted data.

18. A method according to claim 16, wherein the first-layer encryption key and the first-layer cryptographic function are unique to a first component of the information handling system and the second-layer encryption key and the second-layer cryptographic function are unique to a second component different than the first component.

19. A method according to claim 18, wherein each of the first component and the second component comprises one of:

a user of the information handling system, a processor of the information handling system, a storage resource of the information handling system, a bus via which a storage resource of the information handling system is coupled, a cryptoprocessor of the information handling system, and an encryption accelerator of the information handling system.

20. A method according to claim 16, further comprising:

decrypting the second-layer encrypted data based on at least one of the second-layer encryption key and the second-layer cryptographic function to produce first-layer encrypted data; and

decrypting the first-layer encrypted data based on at least one of the first-layer encryption key and the first-layer cryptographic function to produce the item of data.